php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #26722 Segmentation fault (overflow) in /gd/libgd/gd.c (ImageFill)
Submitted: 2003-12-26 14:52 UTC Modified: 2004-01-01 20:47 UTC
From: salesteam at luckylovers dot net Assigned:
Status: No Feedback Package: GD related
PHP Version: 4.3.4 OS: Linux Red Hat 7.3
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: salesteam at luckylovers dot net
New email:
PHP Version: OS:

 

 [2003-12-26 14:52 UTC] salesteam at luckylovers dot net
Description:
------------
php_info(): http://207.44.184.74/test/info.php
GD has been installed with Apache (not with php)

APACHE LOGS:
[Fri Dec 26 12:19:20 2003] [notice] child pid 31265 exit signal Segmentation fault (11)
(on every script execution, memory has been tested OK)


BACKTRACE:
---------------------------------------
/install/php-4.3.3/ext/gd/libgd/gd.c(1913) : Block 0x08191CC8 status:
Beginning:      OK (allocated on /install/php-4.3.3/ext/gd/libgd/gd.c:1876, 17 bytes)
      End:      Overflown (magic=0x00000000 instead of 0x2A8FCC84)
                At least 4 bytes overflown
---------------------------------------
/install/php-4.3.3/ext/gd/libgd/gd.c(1876) :  Freeing 0x08191CEC (17 bytes), script=/usr/local/apache/htdocs/vh/www.luckylover
s.net/htdocs/p/pic.php
[Fri Dec 26 15:46:40 2003]  Script:  '/usr/local/apache/htdocs/vh/www.luckylovers.net/htdocs/p/pic.php'
---------------------------------------

GD PROGRAMM:
(line 1876 is 'stack = (struct seg *)emalloc(sizeof(struct seg) * ((int)(im->sy*im->sx)/4)+1);
')

void gdImageFill(gdImagePtr im, int x, int y, int nc)
{
        int l, x1, x2, dy;
        int oc;   /* old pixel value */
        int wx2,wy2;
        /* stack of filled segments */
        //struct seg stack[FILL_MAX],*sp = stack;;
        struct seg *stack;
        struct seg *sp;

        if (nc==gdTiled){
                _gdImageFillTiled(im,x,y,nc);
                return;
        }

        wx2=im->sx;wy2=im->sy;
        oc = gdImageGetPixel(im, x, y);
        if (oc==nc || x<0 || x>wx2 || y<0 || y>wy2) return;

        stack = (struct seg *)emalloc(sizeof(struct seg) * ((int)(im->sy*im->sx)/4)+1);
        sp = stack;

        /* required! */
        FILL_PUSH(y,x,x,1);
        /* seed segment (popped 1st) */
        FILL_PUSH(y+1, x, x, -1);



Reproduce code:
---------------
$height=2;
$width=2;
$im=ImageCreate($width,$height);
$crem=ImageColorAllocate ($im, 229,228,202);
ImageFill($im, 0,0,$crem);
ImageJpeg($im);
ImageDestroy($im);

THANK YOU FOR YOUR HELP !


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-12-26 15:06 UTC] iliaa@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip

Does not appear to crash with latest CVS snapshot. 
 [2004-01-01 20:47 UTC] sniper@php.net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Dec 27 05:01:27 2024 UTC